Privacy Policy: Wearo Virtual Try-On for Shopify

1. Who we are

Wearo (the "Service", "we", "us", "our") is a virtual try-on widget operated by Wearo SAS, a company registered in France. Our flagship product is Wearo: Virtual Try-On, a Shopify app that lets storefront shoppers preview garments and accessories on themselves using an AI-generated try-on image, embedded directly on the merchant's product detail pages.

• Public website. https://wearo.io
• Privacy contact. contact@wearo.io
• Postal contact. Available on request from the email above.
• Data Protection Officer. Contactable at the same email; subject line DPO request.

This Privacy Policy explains what personal data we collect when a merchant installs Wearo: Virtual Try-On on their Shopify store and when a shopper uses the widget on that store, why we collect it, where it lives, who can see it, and how you can exercise the rights granted to you by the GDPR, the CCPA, and equivalent data-protection laws.

If you are a shopper who has used the widget and you only want to know what happens to your photos, jump straight to §4 Storefront shoppers and to our shopper photo-processing notice, which is the operative document for photo processing.

If you are a merchant evaluating the app, §3 Shopify merchants is the section for you.

If you are a Shopify reviewer auditing the listing, sections §3 through §9 cover the App Store privacy-disclosure requirements; section §7 addresses the mandatory compliance webhooks specifically.

2. Summary of what we do and do not do

If you spot any inconsistency between this section and the more detailed sections that follow, the detailed section is authoritative. If you spot any inconsistency between this document and what the app actually does, please tell us at contact@wearo.io; we treat that as a P0 bug.

3. Shopify merchants: data we process when you install the app

When you install Wearo: Virtual Try-On from the Shopify App Store, you grant us, through Shopify's standard OAuth flow, the permissions described in your shopify.app.toml. As of V1 (2026-05-04), the requested access scope is read_products only. We do not request, and therefore do not receive, any Protected Customer Data.

3.1 What we receive from Shopify at install time

3.2 What we read from your store while the app is installed

• Product catalogue. Product title, handle, featured image URL, variants, price, and currency. Used to bind the widget to a specific product on a product detail page. Read on demand; not cached server-side beyond the duration of a single widget session.
• Cart attributes you explicitly let the widget set. The widget sets a single cart attribute, _wearo_visitor_id, equal to a UUIDv4 generated in the shopper's browser. This is how we attribute conversions in the merchant's analytics (cf. §4) without depending on read_orders. The merchant's checkout sees this attribute as part of the cart object; it is not PII and contains no information about the shopper beyond a random number.
• Webhook payloads for the five subscriptions declared in shopify.app.toml (customers/data_request, customers/redact, shop/redact, app/uninstalled, app/scopes_update). The full payload is stored in the GdprRequest audit table for the duration described in §3.4.

3.3 What we explicitly do not read

• Customer records. No read_customers, no email addresses of your shoppers, no phone numbers, no addresses.
• Orders. No read_orders. We deliberately removed this scope on 2026-05-04. Conversion attribution in V1 relies exclusively on the cart attribute described in §3.2.
• Inventory, shipping, fulfilments, refunds, discount codes, gift cards, draft orders, Liquid templates, theme files, and any other resource not strictly required to render a try-on. The OAuth token we hold is technically capable of read_products only.
• Shopify Plus checkout extensibility, Shopify Functions, or any other surface that handles payment data. We never see card numbers, billing addresses, or transaction details.

3.4 Retention for merchant data

• Active install. While your app is installed, your shop record, OAuth access token, and any per-user online sessions are retained as long as needed to operate the service for you.
• App uninstall. When you uninstall the app, Shopify sends us an app/uninstalled webhook. We mark your Shop.uninstalledAt immediately. Shopify also subsequently sends a shop/redact webhook (typically 48 hours after uninstall, per Shopify's policy). On receipt of shop/redact, we delete your shop record, its sessions, any cached product data, the widget analytics rows keyed to your clientId, and the try-on images held under that clientId in our object storage. Any copy this automatic sweep does not reach is deleted on request to contact@wearo.io.
• GDPR audit log. The GDPR's accountability principle requires us to be able to demonstrate that we comply with it. To that end we log each of the three GDPR webhooks we receive: topic, shop domain, webhook id, the payload as received from Shopify, receipt and processing timestamps, status, and, if processing failed, the error. We keep these GdprRequest records for as long as we may need to demonstrate compliance, and we use them for no other purpose.

3.5 Where merchant data lives

• Primary database. EEA-resident managed PostgreSQL (Frankfurt region). TLS in transit and AES-256 at rest. Backups are also encrypted and EU-resident.
• Application runtime. EEA-resident serverless container runtime (Belgium region). The runtime is stateless; the only persistent state is the managed PostgreSQL database described above.
• Secrets. Shopify API key + secret, the bridge JWT secret, and the database connection strings live in an EEA-resident managed secret-management service, restricted to a single dedicated service account.
• Build artefacts. Container images live in an EEA-resident managed container registry. Source-code uploads for the build pipeline go through EEA-resident managed object storage and are deleted by the build pipeline's own retention policy.

We do not use any sub-processor outside the EEA for merchant data.

4. Storefront shoppers: data we process when you use the widget

This section is a summary; the operative document for photo processing is our shopper photo-processing notice, to which this document defers in case of conflict.

4.1 What we collect and why

4.2 What we do not collect

• We do not read your name, email, phone number, address, payment information, social-media handles, or any other identifying field. The widget never asks for them and the API contract of our backend does not accept them.
• We do not run facial recognition, biometric identification, age estimation, gender inference, ethnicity inference, expression analysis, or any other inference on your image other than the try-on rendering itself.
• We do not use your image to train or fine-tune any machine-learning model. Our AI inference partner is contractually bound to operate as a stateless inference API: each request is independent, and no model weights are updated based on what we send.
• We do not place advertising cookies. The visitor identifier described in §4.1 is a single random number, not a tracking cookie, and is never shared with ad networks.

4.3 Legal basis (GDPR Article 6)

• For your photo and the generated result: your explicit consent under Article 6(1)(a), given by uploading a photo to the widget. You may withdraw it at any time by closing the widget without uploading a new photo, or by emailing us; see §9.
• For the visitor identifier and analytics in §4.1: legitimate interest under Article 6(1)(f) in attributing conversions and operating the service. This processing involves no special-category data and uses only randomly-generated identifiers; the residual risk to your rights is minimal.
• For the IP address in access logs: legal obligation under Article 6(1)(c), to detect and prevent fraud and abuse.

4.4 Special-category data (GDPR Article 9)

A photograph of a person is, in many jurisdictions, special-category personal data ("biometric data" once processed for unique identification). We do not process your photo for unique identification, biometric profiling, or any Article 9 purpose. The processing is limited to the generation of a single try-on image and its return to you. Were we ever to expand into Article 9 territory, we would request your explicit opt-in consent for that specific new purpose; this Privacy Policy would be amended in the same release; merchants would be re-notified.

4.5 Children

The widget is not directed at children under 16 (under 13 for U.S. users). Merchants who market to under-16 audiences MUST obtain parental consent before letting a child use the widget; this is a contractual obligation under our Terms of Service (section 5). If we become aware that we have processed a photo provided by a child without verifiable parental consent, we delete it.

5. Sub-processors

We use the following sub-processors. The list is exhaustive for the V1 of the Shopify app.

We will update this list before any new sub-processor is engaged for production data, and we will give merchants 30 days' notice (via email to the address registered on the Shopify App Store, or via in-app banner) before any change that affects their data. Merchants may object to a change by uninstalling the app within that window, which triggers the deletion described in §3.4.

6. International transfers

All sub-processors that touch merchant or shopper personal data store that data inside the EEA, with the single exception of Shopify itself, which is the data exporter for the OAuth flow and the GDPR webhooks. Shopify's standard EU-U.S. Data Privacy Framework certification and SCCs are the transfer mechanism for that flow; this is an inherent property of being a Shopify app.

We do not transfer shopper photos or AI-generated try-on results outside the EEA at any point in the pipeline. Each sub-processor in our chain is contractually bound to keep that category of data EEA-resident.

7. Shopify mandatory GDPR webhooks

Shopify requires every public app to subscribe to three compliance webhooks. We do.

• customers/data_request. Triggered when a customer asks the merchant for a copy of the data we hold about them. Because Wearo does not collect customer-identifying data (name, email, address, phone), and because the only data that might tie back to a customer is the cart-attribute UUID _wearo_visitor_id, we record the request in our GDPR audit log, search our storage for any try-on row that matches the visitor IDs the merchant supplies, and respond to the merchant within 30 days with whatever we found (typically: nothing, because a UUID alone is not a customer identifier).
• customers/redact. Triggered when a customer asks the merchant to delete their data. Same rationale as above. We delete any try-on row that matches the supplied visitor IDs, log the deletion in the GDPR audit log, and confirm to Shopify within 30 days.
• shop/redact. Triggered 48 hours after a merchant uninstalls our app. We delete the shop record, its sessions, any cached product data, the widget analytics rows keyed to the shop's clientId, and the try-on images held under that clientId on the shopper tier described in §5. Any copy this automatic sweep does not reach is deleted on request. The shop's GdprRequest audit records are retained as described in §3.4.

We sign every webhook handler with HMAC-SHA256 verification of Shopify's X-Shopify-Hmac-Sha256 header before processing. Failed HMAC → 401 → Shopify retries on its own schedule.

8. Cookies and local storage

We use the browser's localStorage and sessionStorage exclusively, and only on the merchant's storefront (not in the merchant's admin), to store:

• wearo_visitor_id: a UUIDv4. Persisted across sessions in localStorage when allowed; falls back to sessionStorage (per-tab) when localStorage is blocked (Safari ITP, incognito); falls back further to a per-pageload random UUID when both are blocked. This identifier is the cart attribute _wearo_visitor_id (§3.2 / §4.1).
• wearo_tryon_products: a small list of product IDs the user has tried on in the current session, used to inject the cart-attribute property when an add-to-cart happens. sessionStorage only; cleared when the tab closes.

We do not set HTTP cookies on the storefront, neither first- nor third-party. We do not use any analytics, advertising, or fingerprinting library on the storefront.

9. Data subject rights (GDPR / CCPA)

You have the right to:

• Access your personal data and obtain a copy of it,
• Rectify any inaccurate data,
• Erase your personal data ("right to be forgotten"); see our shopper photo-processing notice for the operative procedure,
• Restrict or object to processing under the conditions of Articles 18 and 21 GDPR,
• Port your data to another controller in a structured machine-readable format under Article 20,
• Withdraw consent at any time without affecting the lawfulness of processing performed before the withdrawal,
• Lodge a complaint with your supervisory authority: for France, the CNIL; for other EEA states, the relevant DPA.

For California residents under the CCPA: you have analogous rights of access, deletion, and to opt out of sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising; the right to opt out therefore has no practical scope, but you may still exercise the right of access and deletion.

To exercise any of the above, email contact@wearo.io. We respond within 30 days (15 days where required by California). For deletion requests, please use the subject line GDPR - Erasure request (or CCPA - Deletion request) so the message lands in our compliance queue.

10. Security

• Data in transit is encrypted with TLS 1.2+ on every hop (browser ↔ Wearo, Wearo ↔ Shopify, Wearo ↔ AI inference partner, Wearo ↔ database, Wearo ↔ object storage).
• Data at rest is encrypted with AES-256 by every underlying managed service in our chain.
• Application secrets (Shopify API key, Shopify API secret, the bridge JWT secret, database connection strings) live in an EEA-resident managed secret-management service, accessed only by a dedicated service account with least-privilege access. There is no human standing access to these secrets.
• Field-level encryption of the OAuth accessToken field (additional defence against a database-level compromise) is on our roadmap and will ship before the app crosses the threshold of 50 active merchants. We disclose this publicly here, in good faith, because it is the most material residual risk in V1.
• We rely on Shopify's HMAC signing for all incoming webhooks and on a HS256 JWT bridge between the storefront widget and our AI generation backend; the bridge secret is rotatable and is held in the secret-management service described above.
• We monitor application logs and have alerting on 5xx error rates above 1 % over 5 minutes.

11. Data breach notification

In the event of a personal-data breach affecting your data, we will notify the relevant supervisory authority within 72 hours of becoming aware of it (Article 33 GDPR), and we will notify you (the merchant or the affected shopper) without undue delay where the breach is likely to result in a high risk to your rights and freedoms (Article 34 GDPR).

12. Changes to this policy

We may update this policy. When we do, we update the Last updated line at the top, we re-publish the document at the public URL, and, for any change that materially expands the categories of data we collect, the purposes for which we use it, or the sub-processors that touch it, we notify merchants 30 days in advance via the email address registered on the Shopify Partner Dashboard, and we surface a banner inside the embedded admin until the merchant acknowledges it. Continued use of the app after the effective date constitutes acceptance of the updated policy.

13. Governing law and jurisdiction

This policy is governed by French law. Disputes shall be subject to the exclusive jurisdiction of the courts of Paris, France, subject to any non-waivable consumer-protection rights you may have under the law of your habitual residence.

14. Contact

For any question, request, or complaint relating to this policy or to the personal data we hold:

• Email. contact@wearo.io (subject lines: GDPR - Erasure request, CCPA - Deletion request, DPO request, or any other descriptive subject)
• Mail. Available on request from the email above.
• Response SLA. 30 days (15 days for CCPA where applicable). Acknowledgement sent within one business day.

We are committed to handling your data with the care and the discipline you should expect from a privacy-respectful AI service. If anything in this policy is unclear, write to us; we treat ambiguity as a bug.